Tchap Government Messaging Breach: Detection and Hardening Against Single Account Compromise

---
title: Tchap Anomalous Large Message History Export
id: 9f2e8a14-3d7f-4c5e-9b1a-7c6d5e4f3a2b
status: experimental
description: Detects potential bulk message export from Tchap messaging platform indicating data exfiltration
references:
  - https://www.ssi.gouv.fr/
author: Security Arsenal
date: 2026/06/08
tags:
  - attack.exfiltration
  - attack.t1567
logsource:
  category: webserver
  product: apache
detection:
  selection:
    cs-uri-query|contains:
      - '/api/v4/messages/export'
      - '/api/messages/batch'
    sc-status:
      - 200
  filter:
    cs-uri-query|contains:
      - 'limit=50'
  timeframe: 5m
  condition: selection and not filter | count() > 10
falsepositives:
  - Legitimate archival activities by authorized personnel
level: high
---
title: Tchap Unusual Geographic Access Pattern
id: 8a1d7f23-4e6c-5d8f-0c2b-3a4e5d6c7b8a
status: experimental
description: Detects Tchap access from unusual geographic locations or impossible travel scenarios
references:
  - https://www.ssi.gouv.fr/
author: Security Arsenal
date: 2026/06/08
tags:
  - attack.initial_access
  - attack.t1078
logsource:
  category: authentication
  product: azuread
detection:
  selection:
    AppDisplayName|contains: 'Tchap'
  timeframe: 2h
  condition: selection | count() by SourceIPAddress, UserId > 1
falsepositives:
  - Traveling government officials
  - VPN/proxy usage
level: medium
---
title: Tchap Account Authentication Spike
id: 7b2c6e34-5f7d-6e9f-1d3c-4b5f6e7d8c9b
status: experimental
description: Detects suspicious authentication spikes to Tchap potentially indicating credential stuffing
references:
  - https://www.ssi.gouv.fr/
author: Security Arsenal
date: 2026/06/08
tags:
  - attack.credential_access
  - attack.t1110
logsource:
  category: authentication
  product: azuread
detection:
  selection:
    AppDisplayName|contains: 'Tchap'
    Result: 'Failure'
  timeframe: 15m
  condition: selection | count() by UserId > 20
falsepositives:
  - Account lockouts due to legitimate password errors
  - Integration misconfigurations
level: high

// Hunt for Tchap anomalous access patterns
let TchapApp = \"*Tchap*\";
let Threshold_FailedLogons = 10;
let TimeWindow = 1h;
SigninLogs
| where AppDisplayName contains TchapApp
| extend Location = strcat(City, \", \", State, \", \", CountryOrRegion)
| summarize FailedLogons=countif(Result == \"Failure\"),
            SuccessfulLogons=countif(Result == \"Success\"),
            UniqueIPs=dcount(SourceIPAddress),
            Locations=make_set(Location, 10)
            by UserId, UserPrincipalName, bin(TimeGenerated, TimeWindow)
| where FailedLogons >= Threshold_FailedLogons or SuccessfulLogons > 100
| extend RiskScore = iff(FailedLogons >= Threshold_FailedLogons, \"High\", \"Medium\")
| project TimeGenerated, UserPrincipalName, FailedLogons, SuccessfulLogons, 
          UniqueIPs, Locations, RiskScore
| order by TimeGenerated desc

-- Hunt for Tchap client artifacts and suspicious process activity
SELECT Timestamp, Username, ProcessName, CommandLine, Exe, Pid, PPid
FROM pslist()
WHERE ProcessName =~ 'Tchap'
   OR ProcessName =~ 'tchap'
   OR CommandLine =~ 'tchap'
   OR Exe =~ 'Tchap.app'
   OR Exe =~ 'tchap.exe'

-- Check for Tchap data directories and recent modifications
SELECT FullPath, Size, Mtime, Atime, Mode, Type
FROM glob(globs='/*/Tchap/**')
WHERE Mtime > now() - 24h

-- Hunt for suspicious network connections from Tchap processes
SELECT Connection.Pid, Connection.RemoteAddr, Connection.RemotePort, 
       Connection.State, pslist.Name as ProcessName, pslist.Username
FROM netstat()
LEFT JOIN pslist() ON Connection.Pid = pslist.Pid
WHERE pslist.Name =~ 'Tchap' 
   AND Connection.State =~ 'ESTABLISHED'
   AND Connection.RemotePort NOT IN (443, 80, 5222, 5223)

# Tchap Security Hardening and Incident Response Script
# Run with administrative privileges

# Function to check for running Tchap processes
function Check-TchapProcesses {
    Write-Host \"[*] Checking for running Tchap processes...\" -ForegroundColor Cyan
    $tchapProcesses = Get-Process | Where-Object { $_.ProcessName -like \"*tchap*\" -or $_.MainWindowTitle -like \"*Tchap*\" }
    
    if ($tchapProcesses) {
        Write-Host \"[!] Found running Tchap processes:\" -ForegroundColor Yellow
        $tchapProcesses | Format-Table Id, ProcessName, StartTime, MainWindowTitle -AutoSize
        return $true
    } else {
        Write-Host \"[+] No Tchap processes found running.\" -ForegroundColor Green
        return $false
    }
}

# Function to check Tchap configuration files for suspicious settings
function Check-TchapConfig {
    Write-Host \"[*] Checking Tchap configuration files...\" -ForegroundColor Cyan
    
    $configPaths = @(
        \"$env:LOCALAPPDATA\\Tchap\",
        \"$env:APPDATA\\Tchap\",
        \"$env:PROGRAMDATA\\Tchap\"
    )
    
    foreach ($path in $configPaths) {
        if (Test-Path $path) {
            Write-Host \"[+] Found Tchap config directory: $path\" -ForegroundColor Green
            
            # Check for recently modified files
            $recentFiles = Get-ChildItem -Path $path -Recurse -File | 
                          Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-1) }
            
            if ($recentFiles) {
                Write-Host \"[!] Recently modified files found:\" -ForegroundColor Yellow
                $recentFiles | Format-Table FullName, LastWriteTime, Length -AutoSize
            }
        }
    }
}

# Function to check for suspicious logon events
function Check-SuspiciousLogons {
    Write-Host \"[*] Checking for suspicious Tchap logon events...\" -ForegroundColor Cyan
    
    $events = Get-WinEvent -LogName Security -FilterXPath \"*[System[(EventID=4624)]] and *[EventData[Data[@Name='ProcessName'] and (Data='*Tchap*' or Data='*tchap*')]]\" -ErrorAction SilentlyContinue
    
    if ($events) {
        $recentEvents = $events | Where-Object { $_.TimeCreated -gt (Get-Date).AddHours(-24) }
        
        if ($recentEvents) {
            Write-Host \"[!] Found recent Tchap logon events:\" -ForegroundColor Yellow
            $recentEvents | Format-Table TimeCreated, Id, Message -AutoSize -Wrap
        }
    }
}

# Main execution
Write-Host \"========================================\" -ForegroundColor Magenta
Write-Host \" Tchap Security Hardening Script\" -ForegroundColor Magenta
Write-Host \"========================================\" -ForegroundColor Magenta
Write-Host \"\"

Check-TchapProcesses
Check-TchapConfig
Check-SuspiciousLogons

Write-Host \"\"
Write-Host \"[*] Script completed. Review findings above.\" -ForegroundColor Cyan
Write-Host \"[*] Recommended: Force password reset for all Tchap users if compromise suspected.\